patchwarden 1.5.1 → 1.6.1

package/dist/security/contentRedaction.js

@@ -20,13 +20,13 @@ const RULES = [
     {
         category: "credential_assignment",
         reason: "matched credential assignment",
-        pattern: /\b((?:access[_ -]?token|api[_ -]?key|secret|password|credential|token)\s*[:=]\s*)(["']?)([^\s,"'\]}]{8,})(["']?)/gi,
+        pattern: /\b((?:(?:[A-Za-z][A-Za-z0-9]*[_ -])*(?:access[_ -]?token|refresh[_ -]?token|api[_ -]?key|secret(?:[_ -]?access)?[_ -]?key|client[_ -]?secret|private[_ -]?key|secret|password|credential|token))\s*[:=]\s*)(["']?)([^\s,"'\]}]{8,})(["']?)/gi,
         replace: "$1$2[REDACTED]$4",
     },
     {
         category: "known_token_format",
         reason: "matched known token format",
-        pattern: /\b(?:sk|ghp|github_pat)_[A-Za-z0-9_-]{16,}\b/g,
+        pattern: /\b(?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{16,}|sk_[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_-]{16,}|github_pat_[A-Za-z0-9_-]{16,}|glpat-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{16,}|(?:hf|npm)_[A-Za-z0-9_-]{16,}|(?:sk|rk)_live_[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,})\b/g,
         replace: "[REDACTED TOKEN]",
     },
 ];

package/dist/security/discoveryTokenStore.d.ts

@@ -9,8 +9,8 @@
  * - 不持久化到磁盘（内存 Map，进程内共享，单例）
  * - token 单次使用语义（consumeToken 后即删除）
  */
-import type { ToolRisk } from "../tools/toolRegistry.js";
-import type { ToolProfile } from "../tools/toolCatalog.js";
+import type { ToolRisk } from "../tools/catalog/toolRegistry.js";
+import type { ToolProfile } from "../tools/catalog/toolCatalog.js";
 export interface DiscoveryTokenRecord {
     token: string;
     toolName: string;
@@ -31,6 +31,7 @@ export interface IssueTokenInput {
     allowedScope?: string[];
     ttlMs?: number;
 }
+export declare const MAX_ACTIVE_DISCOVERY_TOKENS = 1024;
 /**
  * 生成并保存 discovery token，返回 token id。
  * token id 格式：dst_{YYYYMMDD}_{randomHex12}

package/dist/security/discoveryTokenStore.js

@@ -13,6 +13,7 @@ import { randomBytes } from "node:crypto";
 import { PatchWardenError } from "../errors.js";
 // ── 常量 ──────────────────────────────────────────────────────────
 const DEFAULT_TTL_MS = 10 * 60 * 1000; // 10 分钟
+export const MAX_ACTIVE_DISCOVERY_TOKENS = 1024;
 // ── 模块级 token store（单例，进程内共享） ───────────────────────
 const tokenStore = new Map();
 // ── 内部工具 ──────────────────────────────────────────────────────
@@ -27,15 +28,29 @@ function generateTokenId() {
     const randomPart = randomBytes(6).toString("hex"); // 12 位 hex
     return `dst_${datePart}_${randomPart}`;
 }
+function pruneTokenStore(nowMs) {
+    for (const [token, record] of tokenStore) {
+        if (Date.parse(record.expiresAt) <= nowMs)
+            tokenStore.delete(token);
+    }
+    while (tokenStore.size >= MAX_ACTIVE_DISCOVERY_TOKENS) {
+        const oldest = tokenStore.keys().next().value;
+        if (!oldest)
+            break;
+        tokenStore.delete(oldest);
+    }
+}
 // ── 公共 API ──────────────────────────────────────────────────────
 /**
  * 生成并保存 discovery token，返回 token id。
  * token id 格式：dst_{YYYYMMDD}_{randomHex12}
  */
 export function issueToken(input) {
-    const now = new Date();
+    const nowMs = Date.now();
+    pruneTokenStore(nowMs);
+    const now = new Date(nowMs);
     const issuedAt = now.toISOString();
-    const expiresAt = new Date(Date.now() + (input.ttlMs ?? DEFAULT_TTL_MS)).toISOString();
+    const expiresAt = new Date(nowMs + (input.ttlMs ?? DEFAULT_TTL_MS)).toISOString();
     const token = generateTokenId();
     const record = {
         token,

package/dist/security/loopbackHost.d.ts

@@ -0,0 +1,2 @@
+/** Validate an HTTP Host header for a service bound to IPv4 loopback. */
+export declare function isTrustedLoopbackHostHeader(value: string | string[] | undefined, expectedPort: number): boolean;

package/dist/security/loopbackHost.js

@@ -0,0 +1,16 @@
+import { firstHeaderValue } from "./secretComparison.js";
+const LOOPBACK_HOST_RE = /^(127\.0\.0\.1|localhost)(?::([0-9]{1,5}))?$/i;
+/** Validate an HTTP Host header for a service bound to IPv4 loopback. */
+export function isTrustedLoopbackHostHeader(value, expectedPort) {
+    const raw = firstHeaderValue(value).trim();
+    const match = LOOPBACK_HOST_RE.exec(raw);
+    if (!match)
+        return false;
+    if (match[2] === undefined)
+        return true;
+    const declaredPort = Number(match[2]);
+    return Number.isInteger(declaredPort)
+        && declaredPort >= 1
+        && declaredPort <= 65_535
+        && declaredPort === expectedPort;
+}

package/dist/security/pathGuard.js

@@ -1,5 +1,5 @@
 import { basename, dirname, isAbsolute, normalize, parse, resolve, sep, } from "node:path";
-import { realpathSync } from "node:fs";
+import { lstatSync, readlinkSync, realpathSync } from "node:fs";
 import { PatchWardenError } from "../errors.js";
 export function guardPath(requestedPath, workspaceRoot, allowedPrefix) {
     const ws = normalize(resolve(workspaceRoot));
@@ -55,7 +55,7 @@ function realPathOrSelf(value) {
         return normalize(value);
     }
 }
-function realPathOrExistingPrefix(candidate) {
+function realPathOrExistingPrefix(candidate, seenLinks = new Set()) {
     const normalized = normalize(candidate);
     const root = parse(normalized).root;
     const suffix = [];
@@ -64,7 +64,33 @@ function realPathOrExistingPrefix(candidate) {
         try {
             return resolve(realpathSync(current), ...suffix);
         }
-        catch {
+        catch (error) {
+            try {
+                const metadata = lstatSync(current);
+                if (metadata.isSymbolicLink()) {
+                    const linkKey = process.platform === "win32" ? current.toLowerCase() : current;
+                    if (seenLinks.has(linkKey)) {
+                        throw new PatchWardenError("workspace_path_escape", `Symbolic link cycle detected while resolving "${candidate}"`, "Remove the cyclic link and use a path inside the configured workspace.", true, { path: candidate, operation: "path_access", safe_alternative: "Use a non-link path inside workspaceRoot." });
+                    }
+                    const nextSeen = new Set(seenLinks);
+                    nextSeen.add(linkKey);
+                    const linkTarget = readlinkSync(current);
+                    const resolvedTarget = isAbsolute(linkTarget)
+                        ? resolve(linkTarget)
+                        : resolve(dirname(current), linkTarget);
+                    return resolve(realPathOrExistingPrefix(resolvedTarget, nextSeen), ...suffix);
+                }
+            }
+            catch (linkError) {
+                if (linkError instanceof PatchWardenError)
+                    throw linkError;
+                const linkCode = linkError.code;
+                if (linkCode !== "ENOENT" && linkCode !== "ENOTDIR")
+                    throw linkError;
+            }
+            const code = error.code;
+            if (code !== "ENOENT" && code !== "ENOTDIR")
+                throw error;
             suffix.unshift(basename(current));
             const parent = dirname(current);
             if (parent === current)
@@ -72,24 +98,13 @@ function realPathOrExistingPrefix(candidate) {
             current = parent;
         }
     }
-    try {
-        return resolve(realpathSync(root || current), ...suffix);
-    }
-    catch {
-        return normalized;
-    }
+    return resolve(realpathSync(root || current), ...suffix);
 }
 function assertInside(candidate, root, requestedPath, message) {
     const normalizedRoot = normalize(root);
     const normalizedCandidate = normalize(candidate);
-    const checkRoot = process.platform === "win32"
-        ? normalizedRoot.toLowerCase()
-        : normalizedRoot;
-    const checkCandidate = process.platform === "win32"
-        ? normalizedCandidate.toLowerCase()
-        : normalizedCandidate;
-    if (checkCandidate !== checkRoot &&
-        !checkCandidate.startsWith(checkRoot + sep)) {
+    if (normalizedCandidate !== normalizedRoot &&
+        !normalizedCandidate.startsWith(normalizedRoot + sep)) {
         if (message.startsWith("Path escapes workspace")) {
             throw new PatchWardenError("workspace_path_escape", `Path escapes workspace: "${requestedPath}" resolves to "${normalizedCandidate}" which is outside "${normalizedRoot}"`, "Use a path inside the configured workspace and allowed prefix.", true, { path: requestedPath, operation: "path_access", safe_alternative: "Read a path inside the configured workspace and allowed prefix." });
         }

package/dist/security/planGuard.js

@@ -1,4 +1,5 @@
 import { PatchWardenError } from "../errors.js";
+import { redactSensitiveContent } from "./contentRedaction.js";
 const PLAN_RULES = [
     {
         id: "plan_secret_access",
@@ -35,7 +36,7 @@ export function guardPlanContent(title, content) {
             throw new PatchWardenError(rule.id, `save_plan blocked content in category "${rule.category}".`, rule.suggestion, true, {
                 operation: "save_plan",
                 matched_category: rule.category,
-                matched_text: match[0].slice(0, 160),
+                matched_text: redactSensitiveContent(match[0]).content.slice(0, 160),
             });
         }
     }

package/dist/security/runtimeGuard.js

@@ -1,6 +1,7 @@
 import { resolve, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { PatchWardenError } from "../errors.js";
+import { isPathChildOf, isSamePath } from "../utils/platform.js";
 const CRITICAL_RUNTIME_DIRS = ["dist", "src", "scripts", "release"];
 /**
  * Refuse operations against the active PatchWarden runtime directory or its
@@ -8,15 +9,17 @@ const CRITICAL_RUNTIME_DIRS = ["dist", "src", "scripts", "release"];
  * and direct-session flows share the same protection.
  */
 export function guardRuntimeSelfModification(resolvedRepoPath) {
-    const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-    if (resolvedRepoPath === runtimeRoot ||
-        resolvedRepoPath.startsWith(runtimeRoot + resolve("/")[0])) {
+    // runtimeGuard lives at <package-root>/{src,dist}/security/runtimeGuard.*.
+    const runtimeRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+    const isRuntimeRoot = isSamePath(resolvedRepoPath, runtimeRoot);
+    if (isRuntimeRoot ||
+        isPathChildOf(resolvedRepoPath, runtimeRoot)) {
         const isCritical = CRITICAL_RUNTIME_DIRS.some((dir) => {
             const full = join(runtimeRoot, dir);
-            return (resolvedRepoPath === full ||
-                resolvedRepoPath.startsWith(full + resolve("/")[0]));
+            return (isSamePath(resolvedRepoPath, full) ||
+                isPathChildOf(resolvedRepoPath, full));
         });
-        if (resolvedRepoPath === runtimeRoot || isCritical) {
+        if (isRuntimeRoot || isCritical) {
             throw new PatchWardenError("runtime_self_modification_blocked", `repo_path points to the active PatchWarden runtime or its critical subdirectories.`, "Use a dev copy or git worktree for PatchWarden development. The running MCP server must not be modified by a task.", true, {
                 operation: "runtime_guard",
                 path: resolvedRepoPath,

package/dist/security/secretComparison.d.ts

@@ -0,0 +1,3 @@
+/** Compare secret text without content-dependent byte comparison. */
+export declare function timingSafeStringEqual(actual: string, expected: string): boolean;
+export declare function firstHeaderValue(value: string | string[] | undefined): string;

package/dist/security/secretComparison.js

@@ -0,0 +1,11 @@
+import { timingSafeEqual } from "node:crypto";
+/** Compare secret text without content-dependent byte comparison. */
+export function timingSafeStringEqual(actual, expected) {
+    const actualBytes = Buffer.from(actual, "utf-8");
+    const expectedBytes = Buffer.from(expected, "utf-8");
+    return actualBytes.length === expectedBytes.length
+        && timingSafeEqual(actualBytes, expectedBytes);
+}
+export function firstHeaderValue(value) {
+    return Array.isArray(value) ? (value[0] || "") : (value || "");
+}

package/dist/security/sensitiveGuard.d.ts

@@ -1,2 +1,7 @@
+/**
+ * Detect a Windows NTFS alternate data stream suffix. The colon in an
+ * absolute drive prefix (for example, C:\\) is the only permitted colon.
+ */
+export declare function hasWindowsAlternateDataStream(filePath: string): boolean;
 export declare function isSensitivePath(filePath: string): boolean;
 export declare function guardSensitivePath(filePath: string): void;

package/dist/security/sensitiveGuard.js

@@ -7,22 +7,28 @@ const SENSITIVE_PATTERNS = [
     // Exact filenames
     /(?:^|[\\/])\.env$/i,
     /(?:^|[\\/])\.env\..+$/i,
+    /(?:^|[\\/])\.envrc$/i,
     /(?:^|[\\/])id_rsa$/i,
+    /(?:^|[\\/])id_dsa$/i,
     /(?:^|[\\/])id_ed25519$/i,
     /(?:^|[\\/])id_ecdsa$/i,
     /(?:^|[\\/])\.ssh[\\/]/i,
     // Credentials / tokens
-    /(?:^|[\\/])credentials/i,
+    /(?:^|[\\/])credentials(?:\.(?:txt|json|ya?ml|toml|ini|cfg|db))?$/i,
     /(?:^|[\\/])\.?aws[\\/]credentials/i,
     /(?:^|[\\/])\.netrc$/i,
     /(?:^|[\\/])\.npmrc$/i,
     /(?:^|[\\/])\.pypirc$/i,
-    /(?:^|[\\/])token/i,
+    /(?:^|[\\/])token$/i,
+    /(?:^|[\\/])tokens?\.(?:txt|json|ya?ml|toml|ini|cfg|db)$/i,
+    /(?:^|[\\/])token[-_](?:store|cache|data|secret|auth|credentials|backup|local|prod|production|dev|development)(?:\.[^\\/]+)?$/i,
+    /(?:^|[\\/])(?:access[_-]?token|refresh[_-]?token|api[_-]?key|client[_-]?secret)(?:\.(?:txt|json|ya?ml|ini|cfg))?$/i,
     // Private keys
     /(?:^|[\\/])[^.]+\.pem$/i,
     /(?:^|[\\/])[^.]+\.key$/i,
     /(?:^|[\\/])[^.]+\.pfx$/i,
     /(?:^|[\\/])[^.]+\.p12$/i,
+    /(?:^|[\\/])[^.]+\.ppk$/i,
     // Browser data
     /(?:^|[\\/])cookies/i,
     /(?:^|[\\/])web data$/i,
@@ -30,17 +36,30 @@ const SENSITIVE_PATTERNS = [
     /(?:^|[\\/])local state$/i,
     // Other sensitive files
     /(?:^|[\\/])\.git-credentials$/i,
+    /(?:^|[\\/])\.git[\\/]config$/i,
     /(?:^|[\\/])\.docker[\\/]config\.json$/i,
     /(?:^|[\\/])\.kube[\\/]config$/i,
+    /(?:^|[\\/])kubeconfig$/i,
+    /(?:^|[\\/])application_default_credentials\.json$/i,
+    /(?:^|[\\/])service[-_]?account(?:[-_][^\\/]+)?\.json$/i,
     /(?:^|[\\/])config\.json$/i, // generic config files often contain local tokens or service credentials
 ];
-// Files specifically inside .patchwarden are always allowed
-const SAFE_PREFIX = ".patchwarden";
+/**
+ * Detect a Windows NTFS alternate data stream suffix. The colon in an
+ * absolute drive prefix (for example, C:\\) is the only permitted colon.
+ */
+export function hasWindowsAlternateDataStream(filePath) {
+    const withoutDrivePrefix = /^[A-Za-z]:[\\/]/.test(filePath)
+        ? filePath.slice(2)
+        : filePath;
+    return withoutDrivePrefix.includes(":");
+}
 export function isSensitivePath(filePath) {
-    // Files inside .patchwarden are always safe
-    const normalized = filePath.replace(/\\/g, "/");
-    if (normalized.includes(`${SAFE_PREFIX}/`) || normalized.endsWith(SAFE_PREFIX)) {
-        return false;
+    if (filePath.includes("\0"))
+        return true;
+    // ADS can hide content behind an otherwise safe-looking filename.
+    if (hasWindowsAlternateDataStream(filePath)) {
+        return true;
     }
     for (const pattern of SENSITIVE_PATTERNS) {
         if (pattern.test(filePath)) {

package/dist/security/toolInvocationGuard.d.ts

@@ -14,8 +14,8 @@
  *
  * 加上 consumeToken 内的 token_not_found / token_expired，共 10 项调用前强制校验。
  */
-import { type PatchWardenToolMeta } from "../tools/toolRegistry.js";
-import type { ToolProfile } from "../tools/toolCatalog.js";
+import { type PatchWardenToolMeta } from "../tools/catalog/toolRegistry.js";
+import type { ToolProfile } from "../tools/catalog/toolCatalog.js";
 import type { DiscoveryTokenRecord } from "./discoveryTokenStore.js";
 export interface GuardInput {
     toolName: string;

package/dist/security/toolInvocationGuard.js

@@ -16,7 +16,7 @@
  */
 import { PatchWardenError } from "../errors.js";
 import { guardSensitivePath } from "./sensitiveGuard.js";
-import { TOOL_RISK_RANK } from "../tools/toolRegistry.js";
+import { TOOL_RISK_RANK } from "../tools/catalog/toolRegistry.js";
 // ── 内部常量 ──────────────────────────────────────────────────────
 /**
  * 常见路径参数字段名，用于 workspace_read_sensitive 校验时扫描 args。

package/dist/security/workspaceRootGuard.d.ts

@@ -0,0 +1,8 @@
+export interface WorkspaceRootValidation {
+    ok: boolean;
+    path: string;
+    reason: string | null;
+    category: "valid" | "missing" | "not_directory" | "unsafe_root";
+}
+export declare function unsafeWorkspaceRootLabel(value: string, userHome?: string): string | null;
+export declare function validateWorkspaceRoot(value: string, userHome?: string): WorkspaceRootValidation;

package/dist/security/workspaceRootGuard.js

@@ -0,0 +1,47 @@
+import { existsSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, normalize, resolve, win32 } from "node:path";
+function normalizeInput(value) {
+    return /^[a-z]:[\\/]/i.test(value) ? win32.normalize(value) : normalize(resolve(value));
+}
+function comparable(value) {
+    return normalizeInput(value).replace(/[\\/]+$/, "").toLowerCase();
+}
+export function unsafeWorkspaceRootLabel(value, userHome = homedir()) {
+    const resolved = normalizeInput(value);
+    const trimmed = resolved.replace(/[\\/]+$/, "");
+    const windowsStyle = /^[a-z]:[\\/]/i.test(value) || /^\\\\/.test(value);
+    const leaf = (windowsStyle ? win32.basename(trimmed) : basename(trimmed)).toLowerCase();
+    if (/^[a-z]:$/i.test(trimmed) || trimmed === "" || trimmed === "/")
+        return "drive root";
+    if (comparable(trimmed) === comparable(userHome))
+        return "user home directory";
+    if (leaf === "desktop")
+        return "Desktop";
+    if (leaf === "downloads")
+        return "Downloads";
+    if (leaf === "documents")
+        return "Documents";
+    return null;
+}
+export function validateWorkspaceRoot(value, userHome = homedir()) {
+    const lexicalPath = normalize(resolve(value || "."));
+    if (!existsSync(lexicalPath)) {
+        return { ok: false, path: lexicalPath, reason: "workspaceRoot does not exist", category: "missing" };
+    }
+    let resolved;
+    try {
+        resolved = normalize(realpathSync(lexicalPath));
+        if (!statSync(resolved).isDirectory()) {
+            return { ok: false, path: resolved, reason: "workspaceRoot is not a directory", category: "not_directory" };
+        }
+    }
+    catch {
+        return { ok: false, path: lexicalPath, reason: "workspaceRoot is not accessible", category: "not_directory" };
+    }
+    const unsafeLabel = unsafeWorkspaceRootLabel(resolved, userHome);
+    if (unsafeLabel) {
+        return { ok: false, path: resolved, reason: `workspaceRoot cannot be ${unsafeLabel}`, category: "unsafe_root" };
+    }
+    return { ok: true, path: resolved, reason: null, category: "valid" };
+}

package/dist/smoke-test.js

@@ -18,32 +18,32 @@ import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";
 import { loadConfig, getConfig, getTasksDir, reloadConfig } from "./config.js";
-import { savePlan } from "./tools/savePlan.js";
-import { getPlan } from "./tools/getPlan.js";
-import { createTask } from "./tools/createTask.js";
+import { savePlan } from "./tools/goals/savePlan.js";
+import { getPlan } from "./tools/goals/getPlan.js";
+import { createTask } from "./tools/tasks/createTask.js";
 import { confirmAssessment, readAssessment, createAssessment } from "./assessments/assessmentStore.js";
 import { captureRepoSnapshot } from "./runner/changeCapture.js";
-import { getTaskStatus } from "./tools/getTaskStatus.js";
-import { getResult, getDiff, getTestLog } from "./tools/taskOutputs.js";
-import { listWorkspace } from "./tools/listWorkspace.js";
-import { readWorkspaceFile } from "./tools/readWorkspaceFile.js";
-import { listTasks } from "./tools/listTasks.js";
-import { cancelTask } from "./tools/cancelTask.js";
-import { retryTask } from "./tools/retryTask.js";
-import { getTaskStdoutTail } from "./tools/getTaskStdoutTail.js";
-import { auditTask } from "./tools/auditTask.js";
-import { getTaskSummary } from "./tools/getTaskSummary.js";
+import { getTaskStatus } from "./tools/tasks/getTaskStatus.js";
+import { getResult, getDiff, getTestLog } from "./tools/tasks/taskOutputs.js";
+import { listWorkspace } from "./tools/workspace/listWorkspace.js";
+import { readWorkspaceFile } from "./tools/workspace/readWorkspaceFile.js";
+import { listTasks } from "./tools/tasks/listTasks.js";
+import { cancelTask } from "./tools/tasks/cancelTask.js";
+import { retryTask } from "./tools/tasks/retryTask.js";
+import { getTaskStdoutTail } from "./tools/tasks/getTaskStdoutTail.js";
+import { auditTask } from "./tools/diagnostics/auditTask.js";
+import { getTaskSummary } from "./tools/tasks/getTaskSummary.js";
 import { guardAgentCommand } from "./security/commandGuard.js";
 import { getToolDefs } from "./tools/registry.js";
-import { buildToolCatalogSnapshot, CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, selectToolsForProfile, } from "./tools/toolCatalog.js";
+import { buildToolCatalogSnapshot, CHATGPT_CORE_TOOL_NAMES, CHATGPT_DIRECT_TOOL_NAMES, selectToolsForProfile, } from "./tools/catalog/toolCatalog.js";
 import { errorPayload } from "./errors.js";
 import { readWatcherStatus } from "./watcherStatus.js";
-import { createDirectSession } from "./tools/createDirectSession.js";
-import { searchWorkspace } from "./tools/searchWorkspace.js";
-import { applyPatch } from "./tools/applyPatch.js";
-import { runVerification } from "./tools/runVerification.js";
-import { finalizeDirectSession } from "./tools/finalizeDirectSession.js";
-import { auditSession } from "./tools/auditSession.js";
+import { createDirectSession } from "./tools/direct/createDirectSession.js";
+import { searchWorkspace } from "./tools/workspace/searchWorkspace.js";
+import { applyPatch } from "./tools/workspace/applyPatch.js";
+import { runVerification } from "./tools/tasks/runVerification.js";
+import { finalizeDirectSession } from "./tools/direct/finalizeDirectSession.js";
+import { auditSession } from "./tools/diagnostics/auditSession.js";
 import { readDirectSession, updateDirectSession } from "./direct/directSessionStore.js";
 import { createHash } from "node:crypto";
 // Resolve the actual node binary path (spawnSync needs it on WSL/Windows)
@@ -418,15 +418,16 @@ const sensitiveFiles = [
     "cookies.sqlite",
     ".git-credentials",
     "config.json",
+    ".patchwarden/.env",
+    ".patchwarden/credentials.json",
 ];
 for (const sf of sensitiveFiles) {
     await testReject(`C. readWorkspaceFile blocks "${sf}"`, () => {
         readWorkspaceFile(sf);
     });
 }
-// Files inside .patchwarden should always be allowed
-await test("C. readWorkspaceFile allows .patchwarden/plans/...", () => {
-    // This should work because .patchwarden files are whitelisted
+// Ordinary PatchWarden artifacts remain readable through their dedicated tool.
+await test("C. getPlan reads ordinary .patchwarden/plans artifacts", () => {
     const plan = savePlan({ title: "Allowlist Test", content: "test" });
     const result = getPlan({ plan_id: plan.plan_id });
     if (!result.content.includes("test"))

package/dist/tools/catalog/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./toolCatalog.js";
+export * from "./toolRegistry.js";
+export * from "./toolSearch.js";
+export * from "./toolUsageStats.js";

package/dist/tools/catalog/index.js

@@ -0,0 +1,4 @@
+export * from "./toolCatalog.js";
+export * from "./toolRegistry.js";
+export * from "./toolSearch.js";
+export * from "./toolUsageStats.js";

package/dist/tools/{toolCatalog.js → catalog/toolCatalog.js}

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
-import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
+import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../../version.js";
+import { stableJsonStringify } from "../../utils/stableJson.js";
 export const CHATGPT_CORE_TOOL_NAMES = [
     "health_check",
     "list_agents",
@@ -101,7 +102,7 @@ export function buildToolCatalogSnapshot(tools, profile) {
         inputSchema: tool.inputSchema,
     }));
     const tool_manifest_sha256 = createHash("sha256")
-        .update(stableJson(manifestInput))
+        .update(stableJsonStringify(manifestInput))
         .digest("hex");
     lastSnapshot = {
         server_version: PATCHWARDEN_VERSION,
@@ -116,13 +117,3 @@ export function buildToolCatalogSnapshot(tools, profile) {
 export function getLastToolCatalogSnapshot() {
     return lastSnapshot ? { ...lastSnapshot, tool_names: [...lastSnapshot.tool_names] } : null;
 }
-function stableJson(value) {
-    if (Array.isArray(value))
-        return `[${value.map(stableJson).join(",")}]`;
-    if (value && typeof value === "object") {
-        const entries = Object.entries(value)
-            .sort(([left], [right]) => left.localeCompare(right));
-        return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`).join(",")}}`;
-    }
-    return JSON.stringify(value);
-}

package/dist/tools/{toolRegistry.d.ts → catalog/toolRegistry.d.ts}

@@ -5,8 +5,9 @@
  * schema digest 使用稳定字段顺序的 canonical JSON → sha256 计算，
  * 用于检测工具 schema 漂移、release check 校验、discover_tools 返回。
  */
+import { stableJsonStringify } from "../../utils/stableJson.js";
 import type { ToolProfile } from "./toolCatalog.js";
-import type { ToolDef } from "./registry.js";
+import type { ToolDef } from "../definitions/toolDefs.js";
 export type ToolRisk = "readonly" | "workspace_read_sensitive" | "workspace_write" | "command" | "release" | "credential_sensitive";
 export declare const TOOL_RISK_RANK: Record<ToolRisk, number>;
 export type ToolMode = "delegate" | "direct" | "audit" | "release" | "diagnostic";
@@ -42,7 +43,7 @@ interface StaticToolMeta {
 /**
  * 稳定 JSON 序列化：按字段名排序，避免 key 顺序导致 digest 漂移。
  */
-export declare function stableJsonStringify(value: unknown): string;
+export { stableJsonStringify };
 /**
  * 计算 inputSchema 的 sha256 digest。
  * 返回格式："sha256:<hex>"
@@ -58,4 +59,3 @@ export declare function buildToolRegistry(tools: ToolDef[]): PatchWardenToolMeta
  * 获取单个工具的元数据（不含 schema digest，digest 需从 registry 获取）。
  */
 export declare function getStaticToolMeta(name: string): StaticToolMeta | undefined;
-export {};

package/dist/tools/{toolRegistry.js → catalog/toolRegistry.js}

@@ -6,6 +6,7 @@
  * 用于检测工具 schema 漂移、release check 校验、discover_tools 返回。
  */
 import { createHash } from "node:crypto";
+import { stableJsonStringify } from "../../utils/stableJson.js";
 export const TOOL_RISK_RANK = {
     readonly: 0,
     workspace_read_sensitive: 1,
@@ -56,7 +57,7 @@ const STATIC_TOOL_META = {
         summary: "列出已配置的本地 agent 及其可用性",
         profiles: ["full", "chatgpt_core"],
         modes: ["delegate", "diagnostic"],
-        tags: ["agent", "list", "config", "codex", "opencode"],
+        tags: ["agent", "list", "config", "local-cli", "model"],
         aliases: ["agents", "list_agent"],
         risk: "readonly",
         requiresConfirmation: false,
@@ -201,7 +202,7 @@ const STATIC_TOOL_META = {
         modes: ["delegate", "audit"],
         tags: ["safe", "audit", "checks", "acceptance", "task"],
         aliases: ["safe_audit", "audit_summary"],
-        risk: "readonly",
+        risk: "workspace_write",
         requiresConfirmation: false,
         relatedTools: ["audit_task", "safe_result"],
     },
@@ -545,7 +546,7 @@ const STATIC_TOOL_META = {
         modes: ["direct", "audit"],
         tags: ["safe", "direct", "finalize", "summary"],
         aliases: ["safe_finalize", "finalize_summary"],
-        risk: "readonly",
+        risk: "workspace_write",
         requiresConfirmation: false,
         relatedTools: ["finalize_direct_session", "safe_direct_summary"],
     },
@@ -556,7 +557,7 @@ const STATIC_TOOL_META = {
         modes: ["direct", "audit"],
         tags: ["safe", "direct", "audit", "session"],
         aliases: ["safe_direct_audit", "audit_direct_summary"],
-        risk: "readonly",
+        risk: "workspace_write",
         requiresConfirmation: false,
         relatedTools: ["audit_session", "safe_finalize_direct_session"],
     },
@@ -798,17 +799,7 @@ const STATIC_TOOL_META = {
 /**
  * 稳定 JSON 序列化：按字段名排序，避免 key 顺序导致 digest 漂移。
  */
-export function stableJsonStringify(value) {
-    if (Array.isArray(value)) {
-        return `[${value.map(stableJsonStringify).join(",")}]`;
-    }
-    if (value !== null && typeof value === "object") {
-        const entries = Object.entries(value)
-            .sort(([left], [right]) => left.localeCompare(right));
-        return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableJsonStringify(entry)}`).join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
+export { stableJsonStringify };
 /**
  * 计算 inputSchema 的 sha256 digest。
  * 返回格式："sha256:<hex>"

package/dist/tools/definitions/toolDefs.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Tool definitions for PatchWarden MCP server.
+ *
+ * Extracted from registry.ts to keep the registry focused on dispatch
+ * wiring. getToolDefs() builds the active tool list based on config
+ * (test/direct allow-lists, agent names, profile selection) and refreshes
+ * the tool catalog snapshot as a side effect.
+ */
+export interface ToolDef {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: Record<string, unknown>;
+        required?: string[];
+    };
+}
+export declare function getToolDefs(): ToolDef[];